A business plan is a sensitive document
It holds your turnover, what you pay people, what your household needs to live on, and usually your home address. Here is exactly how that is kept — in enough detail that you can judge it rather than trust it.
One customer cannot reach another’s plan
Not because the code remembers to filter — because the database refuses. Every plan belongs to a workspace, and row-level security policies decide what each connection may see. The application connects as a role that has no way to switch that off; the unrestricted role is a different set of credentials entirely.
Passwords are never stored, and never leave the database
They are hashed with bcrypt and compared inside PostgreSQL, so the hash is never loaded into the application at all. The credential table has no policy and no grant for the application role: there is no query it can run that reaches one.
Sessions can be ended, and are
Only a hash of your session token is stored, so a copy of that table is not a set of keys. Signing out revokes the session on the server. Changing your password ends every other session you have open. Eight wrong passwords locks the account for fifteen minutes.
Your AI key stays in your browser
Drafting is optional and off until you turn it on. If you use your own key it is kept in your browser’s local storage and never sent to our server, so we cannot use it, lose it or be compelled to hand it over. The text a draft needs does reach an AI provider, and some providers may retain it — leave drafting off and the offline composer writes every section instead.
Staff cannot read your plan on a whim
Administrators see accounts, workspaces and plan counts — not the inside of a plan. Reading plan content is a separate, unrestricted action that requires a stated reason of at least eight characters, and the record is written before the access happens, with who did it and what standing they held at the time.
The audit log cannot be edited
Through the application connection it can be appended to and nothing else — not read, not altered, not deleted, including by the person it is about. That is what makes it evidence rather than a note.
You can use the whole thing without sending us anything
Without an account, the plan is written to your browser’s storage and never leaves the machine. There is no telemetry, no analytics script and no advertising pixel on the site or in the app. The trade is simple and it is yours to make: nothing leaves, and nothing is backed up either — clear your browser data and the plan is gone.
With an account, the plan is stored on the server so it survives that machine, and everything on this page applies to it.
Tested, not asserted
The database policies are attacked by a suite that rebuilds a throwaway PostgreSQL from the schema and tries to break in — reading another workspace's plans, writing to one it does not belong to, escalating its own role. The API is attacked over real HTTP by another suite, as a stranger would, with no session and with somebody else's. Both run on every build, and a failure stops the build.
That is the difference worth caring about: these are not claims somebody wrote on a page, they are checks that have to pass before the code you are using can ship.
Found something? Write to [email protected] with enough detail to reproduce it. You will get a reply, and credit if you want it.